CVE-2016-7090: Infoleak
The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7090?
CVE-2016-7090 is rated as having a medium severity due to the potential risk of session cookie interception by attackers.
How do I fix CVE-2016-7090?
To mitigate CVE-2016-7090, upgrade the firmware of Siemens SCALANCE M-800 and S615 modules to version 4.02 or higher.
What systems are affected by CVE-2016-7090?
CVE-2016-7090 affects Siemens SCALANCE M-800 and S615 modules running firmware versions prior to 4.02.
What is the nature of the vulnerability in CVE-2016-7090?
The vulnerability in CVE-2016-7090 involves the integrated web server not setting the secure flag for the session cookie in HTTPS sessions.
Can CVE-2016-7090 be exploited remotely?
Yes, CVE-2016-7090 can be exploited remotely by attackers intercepting the insecure cookie transmission over HTTP.